UEFI/MBR a1ive grub2 File Manager (agFM)

agFM is an open-source grub2 Legacy\UEFI add-on file manager menu system (developed by a1ive). 
 
I recommend using the E2B menu system for Legacy booting and the agFM UEFI menu system for UEFI booting.
 
agFM is new for 2020
 
  • Direct UEFI-boot from Windows Install ISO files (even >4GB)), Linux ISOs, WIM, VHD, EFI and IMG files.
  • Secure UEFI-boot to most ISOs.
  • Secure UEFI-boot from FAT32 Windows Install .imgPTN files + other OS's.
  • Secure UEFI-boot to FAT32+NTFS .imgPTN files (e.g. for large Windows Install ISOs >4GB).
  • Configurable menu theme/wallpaper/text colours/layout/user startup menu
  • Add your own menu entries for special functions such as Linux+persistence, etc.
  • eBook #4 (PDF) - UEFI multiboot using the agFM grub2 File Manager. How to add Linux ISOs, DLCBoot, Strelec WinPE, HBCD, Gandalf, Medicat, Kaspersky, DrWeb, Eset, Norton Rescue, Avast, GData, Trend Micro AV, Adaware, Comodo AV, Windows Install ISOs, etc.
I recommend you update to E2B v2.00 or later which has better support for the agFM.
E2B v2 will automatically download agFM when you create a new E2B USB drive.
See 'Instructions' section below or eBook #4 for details.
 
DOWNLOAD:
 
agFM is very new and you should check for the most recent version and follow my blog for changes, etc..
 
agFM for E2B is still under active development, please contact me if you find any issues with the latest version of agFM and the latest Beta version of E2B.
Please make a donation to a1ive (click Sponsor) if you use agFM.
 

To update the agFM files

1. Download latest E2B UEFI File Manager.zip and extract all files to the 2nd FAT32 partition 
    - OR -
   Run "\e2b\Update agFM\Download and update agFM.cmd" on the FAT32 2nd partition or "\_ISO\docs\Make_E2B_USB_Drive\Download and update agFM.cmd" on the E2B first partition to download agFM and update to the latest current release version.
 
Check the  E2B Alternate download areas  for any new Beta versions of agFM.
 
2. If you have used any .cfg files or .grubfm menu  files, compare them with the 'Menu Files to copy to payload volume' files to see if there is now a better version.
 
Info: The main agFM files are:
  • \grubfmx64.efi - UEFI64 boot file
  • \EFI\BOOT\bootia32.efi - UEFI32 boot file
  • \e2b\grubfm.iso - MBR\Legacy boot file

Introduction

The E2B UEFI File Manager (agFM) .zip download file contains a1ive's version of grub2 and the grub2 File Manager (Open Source on GitHub) and also boot files so we can Secure UEFI64-boot directly from the payload files on the E2B USB drive. Just extract and copy the agFM files to the FAT32 2nd partition.
 
Partition 1 E2B:               PRIMARY NTFS   - E2B files + added payload files (max. 128GB for best compatibility)
Partition 2 PTN2:             PRIMARY FAT32 - agFM files                               (max. 32GB)
Partition 3 PTN3:             PRIMARY NTFS   - image files and user files           (*optional)
Partition 4   -                    MUST BE UNUSED
 
Now UEFI-boot to the second partition, then browse to and select the payload\ISO file and boot from it.
 
  • Secure UEFI64 should work without needing to disable Secure Boot (even for unsigned ISOs). 
  • The agFM can switch-in .imgPTN files or restore the E2B partition - you do not need to first boot to WinPE or MBR-boot!
  • Windows Install ISOs also work with SDI_CHOCO XML files for a Windows 10 fully automated install with drivers and apps from the ISO file!
ISO boot options:
  • Install Windows - use to install Windows from a Windows Install ISO
  • Boot ISO (Easy2Boot/partnew) - mainly used for Linux ISOs - files must be contiguous
  • Boot ISO (map) - only works for some ISOs
  • Easy2Boot Image Partition (.imgPTN) - mainly used for Secure UEFI64-boot to Windows Installers or AIO WinPE OS's
  • User menu - runs the user-added .grubfm menu file, if present
 

File types

File extensions are not case sensitive when using the agFM menu system.
 
Supports Secure UEFI64, UEFI64, UEFI32 as well as MBR\Legacy booting:
 
.ISO - Linux, Windows Install, WinPE, Android (Windows Install ISO may require 2GB RAM or more)
.XML - unattend.xml files can be used with Windows Install ISOs
.IMG - disk image
.VHD - Virtual Hard Disk Image
.WIM - NT6 wim file (using wimboot or NTBOOT)
.EFI - EFI applications, boot loaders, etc. (e.g. MemTest86, KonBoot)
.LUA - lua scripts
.CFG - Special grub2 menus or grub2 commands
.GRUBFM - grub2 menus or commands written for the grubfm menu system - e.g. Ubuntu ISO + persistence
.LST - grub4dos menu (MBR mode only)
Other extensions: .IPXE (ipxe boot file), .MOD (grub2 module), .PF2 (loads a grub2 font file - e.g. unicode-large.pf2), .JPG and  .PNG (display only).
 

E2B File extensions

.IMGPTN, .IMGPTN23, .IMGPTNAUTO, .IMGPTN23AUTO, .ISO01, .ISOdd, .ISOdefault, .ISOdef, .ISOPE, .ISOPE01, .ISO32, .ISO64, .ISOloop, .ISOmap, .isomem, .isopersist
 
See Ptn2: \boot\grubfm\types folder for a list of E2B extensions that are recognised by agFM.
 
Note that other E2B files extensions will not be recognised (e.g. .iso64pwd. .isofira01, etc.) or may not function in quite the same way as E2B. Please contact me if you need a particular extension. Always use E2B for MBR\Legacy booting. If necessary you can use two copies of the same payload file but with different extensions. agFM payload files do not have to use the E2B Menu folders, so you can place agFM payload files in a different folder (e.g. \_ISO\agFM\LINUX) so they do not appear in the E2B menu system.
 
Feature table:
Includes Windows Install ISOs with XML files.
 
Note: For UEFI Secure Boot + Install Windows, BIOS may need to be set to UEFI: 'Boot other OS' instead of UEFI: 'Microsoft Windows' or else you will get 0xc000000f 'Windows failed to start' error. OR you can make and add a Windows .imgPTN23 file for Windows Secure Boot (see below).
 
 

Instructions - how to make an E2B+agFM USB drive

The quick and easy way (Windows 10 is required for USB Flash drives)

E2B v2.00 and later versions will make a two-partition E2B USB drive and then automatically download and add the agFM files for you if you have a Windows 10 system or a USB hard disk. 
 
Note: If your USB drive is a Removable USB Flash drive, Windows 10 is required because XP/7/8 can only access the first partition on a Flash drive!
If your USB drive is a Fixed\Hard disk, any Windows OS will work.
 
  1. Download E2B v2.00 or later (extract the .zip file to an empty folder if it is in .zip format)
  2. Run .\Make_E2B.exe as Administrator
  3. Click on the button with the large red arrow (or click on the Gear Wheel button if you want to specify up to three partitions+sizes). 
  4. Then go to Step 5 below...
 

The harder way

Use a Windows 10 system if possible.
 
1. Prepare an E2B USB drive using the E2B download (download and run the .exe file - you may need to disable your antivirus program if it does not allow writes to the boot sector of USB drives).
 
Note: Beta versions of E2B are in .ZIP form. Download the .ZIP file - extract the contents into an empty folder - run \Make_E2B.exe as Administrator. You can update an existing E2B partition or reformat a USB drive.
2. If using E2B v1.B8 or earlier: You will need to delete the second PTN2 partition and create a new FAT32 Primary partition (min. size 100MB or more). It may be necessary to shrink the E2B partition slightly first using EaseUS Partition Master or a similar tool. You can use the Windows Format tool to format a FAT32 partition as Type 0C. I also recommend you always leave the last 1MB of a drive unused for best compatibility with all BIOSes - i.e. there should be 1-10MB or more of unused space after the last partition.
 
Partition 1: Type 07           PRIMARY NTFS  (recommended max. size 128GiB for best compatibility)
Partition 2: Type 0B/0C/0E PRIMARY FAT32 (recommended min. size 100MB, max. 32GiB for best compatibility)
Partition 3: Unused (you can add a partition 3 but it may limit some uses)
Partition 4: Unused (MUST BE FREE)
[leave 1MiB+ of unused disk space at end of drive - *recommended for best BIOS compatibility - last sectors of disk should not be used]
 
If your E2B USB drive is larger than 128GiB, you may want to create a third NTFS partition which can be used to store applications or backup images, etc.
Note that this may limit some E2B features however (e.g. Linux ISO+persistence).
 
Note: Do not use Logical partitions! If it does not UEFI-boot, check the partitions using RMPrepUSB - Drive Info - 0.
 
For UEFI-booting, the partition entries must have the START sectors in ascending order (partition 1 must start before partition 2) and the partitions must not overlap.
 
Example 'RMPrepUSB - DriveInfo - 0' output
Partition 1   SIZE=102398.616MiB   Type: 07 NTFS\exFAT *ACTIVE*
START POS   = CYL:0 HD:32 SEC:33       END POS = CYL:1023 HD:254 SEC:63
START (LBA) = 2,048 (00000800) SIZE (LBA) = 209,712,366 (0C7FF4EE) [End=209,714,413]
 
Partition 2   SIZE=19489.33MiB   Type: 0C FAT32LBA (2047GB max)       
START POS   = CYL:1023 HD:254 SEC:63       END POS = CYL:1023 HD:254 SEC:63
START (LBA) = 209,714,414 (0C7FFCEE) SIZE (LBA) = 39,914,147 (02610AA3) [End=249,628,560]
 
Partition 3 SIZE=0MiB Type: 00
START POS   = CYL:0 HD:0 SEC:0       END POS = CYL:0 HD:0 SEC:0
START (LBA) = 0 (00000000) SIZE (LBA) = 0 (00000000)
 
Partition 4   SIZE=1039.689MiB   Type: 00        
START POS   = CYL:0 HD:0 SEC:0       END POS = CYL:0 HD:0 SEC:0
START (LBA) = 0 (00000000) SIZE (LBA) = 0 (00000000)
 
P1   Start=2,048 (1,048,576 bytes) End=209,714,413 (107,373,779,456 bytes)
P2   Start=209,714,414 (107,373,779,968 bytes) End=249,628,560 (127,809,822,720 bytes)
 
Drive 4  SanDisk Extreme Pro  F/W Rev.=0  Serial No.= [ bytes = 00 00 00 00 00 00 00 00 ]
Reported size 128,043,712,512 bytes (119.25GiB)  Last LBA 250,085,375
RMPrepUSB Max 128,034,708,480 bytes (119.2416GiB)  Last LBA 250,067,789
 
3. If using E2B v1.B8 or earlier: Download the latest 'E2B UEFI File Manager vx.x.zip' file. There may be more than one version. Choose the latest version. Do not download the imgptn file.
The download file can be found in the Alternate Dow nload Areas - a1live grub2 file manager folder (e.g. E2B UEFI File Manager v1.19.zip includes MemTest86, Secure UEFI64 boot and .imgPTN switching).
 
4. If using E2B v1.B8 or earlier: Extract the files from the "E2B UEFI File Manager vx.x.zip' file directly to the 2nd FAT32 partition on the USB drive.
 
Note: If you are using a Win XP/7/8 system, you will not be able to access the 2nd FAT32 partition on the Removable USB drive. You can temporarily switch over partition 1 with partition 2 by running \_ISO\SWITCH_E2B.exe.Make sure you switch them back before UEFI-booting or it may not boot!
 
 
5.  (optionalMove the file \e2b\grub_filemanager.mnu to the \_ISO\MAINMENU folder on the E2B partition. Edit this file to change the language\text if you wish. This will allow you to run the grub2 file manager from the E2B Main Menu. I strongly suggest you use the E2B menu for MBR booting as it should be more successful for most payloads. The agFM menu system however may be able to boot non-contiguous Linux ISOs more successfully. This menu may also add the Clover UEFI boot options.
 
6. Copy the file \_ISO\WINDOWS\WIN8\NO KEY (choose a version to install).xml to the folder \_ISO\WINDOWS\WIN7 (if not already there). You can use this XML file after you select a Windows 7 ISO so that all Win7 Editions wil be available to install.
 
7. Copy your ISO files, VHD files, WIM files, .imgPTN files, EFI files, IMG files, etc, to the first E2B NTFS partition. Use the menu folders which are already provided for you (e.g. \_ISO\MAINMENU, \_ISO\ANTIVIRUS, \_ISO\WINDOWS\WIN10, etc.). Change any .imgPTN file extensions to .imgPTN23 so that the second and third partitions will remain when you switch in a .imgPTN23 file.
 
Note: Payload file names must not contain the $ symbol.
 
8. Run \MAKE_THIS_DRIVE_CONTIGUOUS.cmd to make all the files on the first NTFS partition contiguous. Linux .ISOs and .imgPTN files must be contiguous when using the 'Easy2Boot/partnew' boot options.
You can copy the wincontig folder from the \_ISO\docs folder to any other partition and then run one of the .cmd files to make the files on that partition contiguous (e.g. copy the wincontig folder to partition3 if you have one and have payload files on it).
 
Tip 1: Rename \_ISO\UTILITIES_MEMTEST\Passmark Memtest86 (MBR+UEFI).imgPTN to Passmark Memtest86 (MBR+UEFI).imgPTN23 so it can be easily used with agFM.
 
Tip 2: As with the E2B menu system, if the file extension is .ISO then you will be prompted by agFM with a choice of boot methods, however if you use an E2B file extension (.isodef, .isodefault, .isodd, .iso01, .iso32, .iso64, .isoPE, .isoPE01, .isomem, .isomap, .isoloop) then it will immediately boot the ISO - e.g. use .isodef for Linux ISOs. If the (map) menu entry works then use .isomap. If the (loop) entry works however, you must keep the original Linux filename and the .iso extension.
 
 

Usage

Use the E2B menu system for MBR booting and the grub2 File Manager for UEFI-booting.
You should be able to load the Legacy grub2 File Manager from the E2B Main Menu if you added the .mnu file, or directly UEFI-boot to the UEFI grub2 File Manager.
 

Using the a1ive grub2 File Manager

You can browse to the \_ISO menu folders on the E2B drive to boot payload files such as .ISO, .EFI, .WIM and .VHD files. 
 
.imgPTN files must be on the first partition if you want to UEFI-boot from them. I recommend using .imgPTN23 so that the agFM partition is always available. Files MUST be contiguous.
 
Linux ISOs - Choose the Easy2Boot (partnew) option if available for Linux ISOs (ISO files must be contiguous). Use a .isodef file extension for quick booting.
 
Windows Install ISOs - Choose 'Install Windows' to boot to Windows Install ISOs.
 
Note: For Secure Boot + Install Windows, BIOS may need to be set to UEFI Secure Boot: 'Boot other OS' instead of 'Microsoft Windows' or will get 0xc000000f 'Windows failed to start' error. To change the Secure Boot BIOS option you may need to first set a BIOS Supervisor Password and then reboot back to the BIOS Setup menu on some computers.
If the BIOS is set to Secure Microsoft UEFI, you can install Windows from a Windows Install ISO by first Secure UEFI-booting to a WinPE ISO (e.g. Strelec, Bob Omb's, DLC, Hirens WinPE) and then running WinNTSetup. Alternatively, make a Windows Installer .imgPTN23 file for Secure Boot (see below for details).
Note: If booting to a Windows 7 or Windows 8.1 Install ISO, choose 'Install Windows' and then choose the 'NO KEY (choose a version to install).xml' file to see all Editions in the Win7/8 ISO and to avoid having to enter a Product Key for Win 8.1.
 
You can select an XML file if one is present in the same folder as your Windows Install ISO. This means you can use SDI_CHOCO XML files with your Windows Install ISOs in the same way that it works with MBR\Legacy booting.
 
Choose 'NT5' option to boot to XP-based payloads (does not include E2B DPMS drivers) - I suggest you use the Easy2Boot menu for XP installs.
 
Use .isoPE or .isoPE01 for WinPE ISOs (or keep as .ISO and use the 'map' menu entry). Use .imgPTN23 for DLCBoot, Sergei Strelec WinPE and other AIO WinPE ISOs.
 
You can boot directly from WindowsToGo .VHD or .VHDX files (use the 'Boot Windows NT6.x VHD\VHDx (NTBOOT)' menu entry if UEFI booting. To see this option you may need to select 'F4 - enable secondary boot options' first.
 
You can boot directly to WinPE .WIM files.
 
You can also make your own grub2 menus by using a file with the .cfg or .grubfm file extension. 
 
See here for an example of a Ubuntu-based ISO + persistence.
 
grub2 and linux can be 'fussy' about spaces and non-standard characters in filenames. Always use paths and filenames which do not contain spaces. Once you have it working, then you can try adding spaces and changing the filename. Always avoid using folder paths which contain spaces. Never use a dollar sign ($) in file names!
Tip: Once it is working, try changing the file name and add spaces to see if it still works!
If the graphical menu is slow to scroll, press F4 and then T to switch to terminal mode.
 

Selecting an .ISO file

The agFM may provide you with a list of boot choices after you select a file with a .ISO file extension:
 
 
  • Boot ISO (Easy2Boot\partnew) - writes an entry for the ISO into partiton table entry 4 - the ISO file MUST be contiguous. Use for most Linux ISOs.
  • Install Windows - Usually runs Windows Setup or WinPE. Use if the ISO is a Windows boot ISO. Using .isoPE extension will auto-select this option.
  • Boot ISO (Loopback) - uses the grub2 loopback command - suitable only for booting simple linux kernels unless agFM recognises the ISO (the icon will show the identified Linux distro type). 
  • Boot ISO (loopback.cfg) - use the loopback.cfg file within the ISO - this often contains a cheat code that specifies the name of the ISO to allow booting directly from the ISO file - use if the Easy2Boot\partnew option does not work. Keep the original filename and the .iso extension.
  • Boot ISO (map) - uses the grub4dos map command to map the ISO as cd device (0xff) in Legacy mode, or uses the grub2 map command if UEFI.
  • User menu - runs the .grubfm grub2 file which must have the same path and filename as the ISO file.
If you use a recognised E2B file extension - e.g. .isodef, then the 'Boot ISO (Easy2Boot\partnew)' entry will be automatically used and this secondary menu will not be displayed.
 

F4 Settings Menu

You can switch to Terminal mode, choose to display all files in the menu, change resolution, etc.
 

BIOS bugs!

Many BIOSes have some bugs:
1. In MBR\Legacy mode, files positioned beyond 128GiB on the disk cannot be accessed. This is why the first partition should be no larger than 128GiB.
2. Some UEFI-enabled BIOSes will ALWAYS boot to the grub2 UEFI boot files - you will not be able to boot to the E2B (Legacy) menu even if you enable CSM mode and disable Secure Boot. To fix this, you can temporarily rename the \EFI folder on the 2nd FAT32 partition to something else (e.g. EFIx). This will prevent it from UEFI-booting.
 
Note: If Windows 10 UEFI boot gives a 0xc000000f unexpected error then 'Secure Boot (Microsoft only)' is enabled in the BIOS. 
To fix: disable Secure Boot or set the BIOS to 'Secure Boot (Other OS)' - or use .imgPTN23 partition image files to Secure Boot (see below).
 

Add a grub2 menu

Some ISOs may not be directly UEFI64 bootable or you may want to boot an ISO with different parameters (cheat codes) or boot with persistence.
 
There are two types of grub2 menu files which you can add:
 
  • .cfg files        - these can be placed anywhere but must containg the correct path and filenames for each specific payload file. The user can directly select the .cfg file and run it as a .grub2 menu file.
  • .grubfm files - these must be placed in the same folder as the payload file and have the same file name as the payload file and then the 'User Menu' entry - the user must select the payload file (not the .grubfm file).
The most recent examples of these menu files can be found in the Alternate Download Area - alive grub2 Fil e Manager folder.
 
Example .cfg and grubfm files can be found in the agFM downloaded folder \Menu Files to copy to payload volume (these are not actually used by agFM but just provided as sample files).
 
Note: grub2 environment variables are case-sensitive and can be set and used as below:
 
set "fred=xxxxx"
echo ${fred}
 

.cfg files

You can make a grub2 .cfg file and select the file using the File Manager...
You can create a .cfg file in any folder and the .cfg file can have any filename. 
 
If you select a file and then select the 'File Info' menu entry, then you can see what pre-defined grub2 variables are available. For instance $grubfm_device will be name of the device+partition and $grubfm_dir will be the directory, so you can use (${grubfm_device})${grubfm_dir}fred.iso which will be equivalent to (hd0,msdos1)/_ISO/LINUX/fred.iso (for example). You will however need to 'hard-code' the name of the file (e.g. fred.iso) that you want to boot.
 
(hd0,msdos1) = first partition
(hd0,msdos2) = second partition
 
.cfg files can be directly loaded as a grub2 menu - therefore the .cfg file can be placed anywhere and can boot any file with any extension.
 
Example .cfg files
Open agFM at the /_ISO/WINDOWS/WIN10 folder.
grubfm "(hd0,msdos1)/_ISO/WINDOWS/WIN10/"
 
Open agFM and select a specific file.
grubfm_open "(hd0,msdos1)/_ISO/WINDOWS/WIN10/Windows10x64UK_Oct_2018.iso"
 

Example Windows 10 x64.cfg menu file:

(This example can be placed anywhere on same partition as ISO and XML file).
 
Win10 1909 x64.cfg
menuentry "Install Windows 10 1909 x64 Pro Eng" --class=nt6 {
    set "XML=(${grubfm_device})/_ISO/WINDOWS/WIN10/Windows 10 Pro (no prompt to repair).xml"
    set "ISO=(${grubfm_device})/_ISO/WINDOWS/WIN10/Windows10_1909_x64_English_MS.iso"
    set "grubfm_file=${ISO}"
    source (memdisk)/boot/grubfm/rules/iso/win.sh
    win_isoboot "(loop)/sources/boot.wim"  "${XML}"
}
 
 

Example .cfg file for Ubuntu .isopersist file with persistence

#Ubuntu x64 iso boot with persistence
#No spaces in filename
#Place this .cfg file in the same partition as the .iso file (any folder)
#Assumes persistent file is in root of E2B partition
#ISO file is in \_ISO\LINUX folder
 
# Only show menu if 64-bit CPU:
if [ "$CPU" == "64" ] ; then
menuentry "Ubuntu 64-bit with persistence" --unrestricted --class ubuntu {
# WARNING: partnew will write a new partition entry
   set "grubfm_per=(${grubfm_device})/ubuntu-18.04.3-desktop-amd64-rw"
   set "grubfm_file=(${grubfm_device})/_ISO/LINUX/ubuntu-18.04.3-desktop-amd64.isopersist"
   set "grubfm_path=/_ISO/LINUX/ubuntu-18.04.3-desktop-amd64.isopersist"
 
if [ ! -e "${grubfm_per}" ] ; then 
echo ERROR ${grubfm_per} does not exist on (${grubfm_device}) ; read ; fi
if [ ! -e "${grubfm_file}" ] ; then 
echo ERROR ${grubfm_file} does not exist on (${grubfm_device}) ; read ; fi
if [ ! -e "(${grubfm_device})${grubfm_path}" ] ; then 
echo ERROR (${grubfm_device})${grubfm_path} does not exist on (${grubfm_device}) ; read ; fi
 
   if ! test -d (${grubfm_disk},4) ; then partnew --type=0x00 --file="${grubfm_per}" (${grubfm_disk}) 4 ; fi
   loopback loop "${grubfm_file}"
   set root=(loop)
   linux (loop)/casper/vmlinuz boot=casper persistent iso-scan/filename=$grubfm_path quiet splash
   initrd (loop)/casper/initrd
   boot
}
fi
 
 

.grubfm files

An alternative is to use a .grubfm file. These are automatically added as a new 'User Menu' menu entry when you select a payload file (e.g. after you select Ubuntu.iso). 
 
The filename of the .grubfm file must exactly match the filename of the payload file and must be in the same folder, e.g.
 
\_ISO\LINUX\Ubuntux64.iso            (select the iso)
\_ISO\LINUX\Ubuntux64.grubfm (do NOT select this file)
 
Only valid payload file extensions can be used (e.g. .iso, .vhd, .wim, etc.) when using a .grubfm file.
 
Available grub2 variables when using .grubfm files:
# available variables are:
# grubfm_file  - (dev)+fullpath+name.ext
# grubfm_path  - e.g. /test/ubunto.iso
# grubfm_dir   - e.g. /test/
# grubfm_device - e.g. hd0,msdos1
# grubfm_disk    - e.g. hd0
# grubfm_name    - e.g. ubuntu.iso
# grubfm_filename - e.g. ubuntu
# grubfm_fileext   - e.g. iso
# grub_platform=efi or pc  (UEFI or Legacy BIOS)
# grub_cpu=i386 or x86_64 (i386=Legacy mode or 32-bit UEFI, x86_64=UEFI64)
# grub_uefi_version  (e.g. 2.4)
# grub_secureboot
# CPU  (=32 or 64)
# grubfm_file        - e.g. (hd0,msdos1)/test/ubuntu.iso
# grubfm_path      - e.g. /test/ubunto.iso
# grubfm_dir         - e.g. /test/
# grubfm_device    - e.g. hd0,msdos1
# grubfm_disk       - e.g. hd0
# grubfm_name     - e.g. ubuntu.iso
# grubfm_filename - e.g. ubuntu
# grubfm_fileext     - e.g. iso
# grub_platform=efi or pc  (UEFI or Legacy BIOS)
# grub_cpu=i386 or x86_64 (i386=Legacy mode or 32-bit UEFI, x86_64=UEFI64)
# grub_uefi_version  (e.g. 2.4)
# grub_secureboot
# CPU  (32 or 64)
 
Tip: Use the 'File Info' menu entry to view these variables for the chosen file.
 

Here is a simplified .grubfm menu which uses some of these variables:

 
menuentry "Ubuntu 64-bit with persistence" --unrestricted --class ubuntu {
# WARNING: partnew will write a new partition entry
   if ! test -d (hd0,4) ; then partnew --type=0x00 --file="(${grubfm_device})/persist/${grubfm_filename}" (${grubfm_disk}) 4 ; fi
   loopback loop "${grubfm_file}" 
   set root=(loop)
    linux (loop)/casper/vmlinux boot=casper persistent iso-scan/filename=$grubfm_path quiet splash
    initrd (loop)/casper/$init
   boot
}
 
 

.grubfm menu for Windows Install ISO:

.ISO and .grubfm must have same file name and be in the same folder. Run Windows Install with a specific XML file:
menuentry "Install Windows 10 1909 x64 Pro Eng" --class=nt6 {
    set "XML=Windows 10 Pro (no prompt to repair).xml"
    source (memdisk)/boot/grubfm/rules/iso/win.sh
    loopback loop "${grubfm_file}" 
    win_isoboot "(loop)/sources/boot.wim" "(${grubfm_device})${grubfm_dir}${XML}"
}
 
 

About .imgPTN files

agFM v1.19 and later versions support auxiliary partition image files.
Auxiliary partition image files must have the same filename as the .imgPTN* file but must not have any file extension.
The filename must not contain any dots.
 
All partition image files MUST be contiguous.
Install Defraggler - right click on the file and choose Defragment.
The Auxiliary file search is in this order of preference:
  1. Ptn3 (path)/(filename).
  2. Ptn3 /_ISO/(filename).
  3. Ptn3 /(filename).
  4. Ptn2 (path)/(filename).
  5. Ptn2 /_ISO/(filename).
  6. Ptn2 /(filename).
  7. Ptn1 (path)/(filename).
  8. Ptn1 /_ISO/(filename).
  9. Ptn1 /(filename).
  • Files with the extension .imgPTN or .imgPTNauto will replace Partition 1
  • If an auxilliary file exists with the same filename BUT NO FILE EXTENSION then that will replace Partition 3
  • If the .imgPTN file extension has '23' in it (e.g. .imgPTN23), then Partitions 2 and 3 will not be deleted
  • For UEFI-booting, the final partition table must be in ascending order and must not overlap each other
Note: Auxilliary partition image files should be placed in the 3rd partition to avoid UEFI boot issues.
E2B USB Drive partitions
Ptn1: NTFS E2B files
Ptn2: FAT32 agFM files
Ptn3: NTFS Auxilliary files + user files
 
Recommend always use .imgPTN23
 

Example results:

Ptn1:\_ISO\ANTIVIRUS\FRED.imgPTN
Ptn1: FRED.imgPTN files
Ptn2: (empty)
Ptn3: (empty)
Ptn4: (empty)
 
Ptn1:\_ISO\ANTIVIRUS\FRED.imgPTN23 (recommended)
Ptn1: FRED files
Ptn2: FAT32 agFM files
Ptn3: NTFS Auxilliary files + user files
Ptn4: (empty)
 
Ptn1:\_ISO\ANTIVIRUS\FRED.imgPTN + Ptn3:\FRED
Ptn1: FRED.imgPTN files
Ptn2: (empty)
Ptn3: FRED files
Ptn4: (empty)
 
Ptn1:\_ISO\ANTIVIRUS\FRED.imgPTN23 + Ptn3:\FRED  (recommended)
Ptn1: FRED.imgPTN23 files
Ptn2: FAT32 agFM files
Ptn3: FRED files
Ptn4: (empty)
 
FRED will also be detected if placed in the Ptn3:\_ISO\ANTIVIRUS or Ptn3:\_ISO folder.
 

Using .imgPTN files to Secure Boot to Microsoft OS's

Note: Microsoft has now blocked the boot files used by agFM when Secure Booting from agFM to a Microsoft EFI boot file which requires Secure Boot (Feb 2020 Windows Update). If you experience 'Secure Boot Violation' messages, use the UEFI BIOS pop-up menu to UEFI-boot from Partition 1 after switching-in a FAT32 .imgPTN23 file.
You must boot from a bootx64.efi file (not a .wim or .iso file) if 'Secure Boot (Microsoft only)' is enabled in the BIOS otherwise you may get a '0xc000000f Unexpected error' BSOD.

1. UEFI-boot to agFM and select the .imgPTN23 file, answer the question (1) and the partitions will be changed.
    IMPORTANT: You will need to reboot before you can boot from EFI files on the new Partition 1 because the UEFI firmware will be unaware that the partitions have been changed (even though grub2 will be aware).
 
2. Reboot from the new partition 1 directly to Windows.
    If the system reboots to agFM instead of Windows then press F3 and select the 'Boot hd0,msdos1' option from the F3 boot menu.
 
3. You can restore the original USB drive partitions by booting to the agFM partition and running the \RESTORE_E2B.cfg file which is in the agFM FAT32 second partition. 
   The original MBR and E2B partitions will be restored.
 
 

Non-Secure Boot to large Windows Install ISOs

If the install.wim or install.esd is over 4GB, then create an NTFS .imgPTN23 file using the MPI Tool Kit (instead of using the MPI_FAT32 Desktop shortcut).
It will always reboot to the agFM menu but you should be able to use F3 to boot to (hd0,msdos1) from the NTFS volume.
 
Note: Due to a recent (February 2020) Microsoft Windows update which updates the BIOS blacklist , you may need to disable Microsoft Secure Boot for this to work!

Secure Boot to large Windows Install ISOs

If directly booting from a .ISO file does not work...
 

Method 1

1. Extract all contents of the Windows Install ISO to a new empty folder on your Desktop called 'FAT32'
2. Create a new folder on the Desktop called 'NTFS' and create a folder under it called 'Sources'
3. Cut (move) the two files in .\FAT32\Sources\Setup.exe and the large .\FAT32\Sources\Install.wim (or .esd)
4. Paste the two files into the empty .\NTFS\Sources\ folder
Note: .\FAT32\Sources folder must not contain setup.exe or an install.wim\esd file.
5. Drag-and-drop the FAT32 folder onto the MPI_FAT32 Desktop shortcut and use the default answers to make a C:\temp\Win10.imgPTN23 file
6. Drag-and-drop the NTFS folder onto the MPI_NTFS Desktop shortcut and use the default answers to make a C:\temp\Win10 file
    Note: you may need to increase the default suggested size if there is not enough room.
7. Copy the Win10.imgPTN23 file to the E2B first partition: \_ISO\WINDOWS\WIN10\Win10.imgPTN23
8. Copy the Win10 file to the 3rd NTFS partition (either to the root or \_ISO\WINDOWS\WIN10 folder
9. Run Defraggler and defrag each file to ensure it is contiguous.
 
You can rename the files if you wish (do not use dots in the name).
 
If you are using a Removable USB drive and are using Win7/8 Installl files, you will need to rename the files e.g.  the large NTFS file is \_ISO\WINDOWS\WIN8\Win8.imgPTN23 and the smaller FAT32 file is at Ptn3:\_ISO\WINDOWS\WIN8\Win8.
 
Note: If your ISO has \x64\sources and \x86\sources folders, then replicate both folders in your 'NTFS' folder structure.
 

Method 2

Use Split_WinISO.exe, which is in the MPI Tool Kit, to split the large install.wim/esd file into smaller files and create a single .imgPTN23 file. This may not work for all types of Windows Install ISOs (e.g. non-standard AIO ISOs).
 

WinPE booting

Some WinPE-based ISOs will boot directly (HBCD, Gandalf, Strelec), but many WinPE ISOs such as DLC Boot, Bob Omb's PEs, etc.) work better when the ISO is converted into a .imgPTN file using the E2B MPI Tool Kit.
 
Use the 'Boot ISO (map)' menu entry (or use a .ISOPE file extension) to work with Secure Boot.
 
  • Bob Omb's WinPE - use .iso (map) or .isoPE or .imgPTN23 (recommended).
  • DLCBoot - use .imgPTN23 (see blog)
  • Gandalf WinPE - use .iso (map) or .isoPE or .imgPTN23.
  • HBCD WinPE - use .iso (map) or .isoPE or .imgPTN23.
  • Sergei Strelec - use .imgPTN23 (or extract SSTR folder and use .isoPE).

Instructions to add a WinPE ISO

  • Download the WinPE ISO (e.g. HBCD_PE_X64.iso 1.3GB) and copy it to the E2B NTFS partition - the (map) option will usually work even when in Secure Boot mode.
  • Most WinPEs will boot immediately if you use the .isoPE file extension (same as map option).
  • Some WinPE's are quite large and 2GB+ of RAM may be required.
 

Instructions to add WinPE WIM files

We can directly select a .imgPTN* file using the agFM menu.
 
By adding Microsoft boot .WIM WinPE files, you can install Windows even with a 'Secure UEFI: Microsoft OS only' BIOS setting. 
You can boot to WinPE and run WinNTSetup.exe and then select any Windows Install ISO.
 
When Secure Boot (Microsoft only) is enabled, we can boot from a bootx64.efi boot file:
 
bootx64.efi -> \efi\microsoft\boot\bcd -> \boot\boot.sdi -> \sources\xxxxxx.wim
 
If the following WinPE files are already present, go to Step 6 (or add your own boot.wim file).
 

eBook #3 WinPE files

  1. Download SWPEFAT32_eBook_FILES.zi_ and open in it 7Zip (password is given in eBook #3)
  2. Extract \EFI\Boot\BOOTX64.efi to the root of the FAT32 partition
  3. Rename \BootX64.EFI to \SWITCHPE_x64.EFI
  4. Extract \boot\boot.sdi to the FAT32 partition (\boot\boot.sdi)
  5. Extract the \EFI\microsoft folder to the FAT32 partition (\EFI\microsoft\)
     
  6. Extract and copy the \sources\SWITCH_X64.wim file to the FAT32 partition (\sources\SWITCH_X64.wim). We now have:
  • \SWITCHPE_X64.efi
  • \boot\boot.sdi
  • \EFI\microsoft\boot\bcd
  • \sources\SWITCH_X64.wim  (can also add SWITCH_X32.wim also)
The FAT32 partition must be large enough to contain the .wim file(s).
 
You can use any .wim file of your choice, but 64-bit WinPE must support WoW64 and you may need to add SWITCH_E2B.exe to the FAT32 partition if you don't use the eBook .wim files which already include SWITCH_E2B.exe.
 

Steps for Secure Boot to Install Windows from a .imgPTN file

Requires a pre-made Windows .imgPTN23 file (e.g. \_ISO\WINDOWS\WIN10\Win10_x64_1909.imgPTN23).
 
  1. UEFI Secure Boot to the a1ive grub2 File Manager
    Ptn1: E2B menu system (MBR only)
    Ptn2: a1ive grub2 File Manager (MBR+UEFI) + WinPE .wim file(s)
  2. Select the desired .imgPTN23 file - we now have:
    Ptn1: Windows 10 (UEFI)
    Ptn2: a1ive grub2 File Manager (UEFI)
  3. Reboot to the new image on partition 1 (there may be two UEFI USB boot options in the BIOS Boot menu - you must pick the correct one or it will boot to the agFM again!). If you do boot to the agFM, then you can boot run the \EFI\BOOT\BOOTX64.EFI file on partition #1 to boot to Windows.
  4. Install Windows 10
  5. Reboot to agFM and select \RESTORE_E2B.cfg
    Ptn1: E2B menu system (MBR only)
    Ptn2: a1ive grub2 File Manager (MBR+UEFI)
  6. The E2B USB drive now contains the Easy2Boot menu system in partition 1.
 

Add an agFM Startup menu

agFM v1.11 and later versions will allow you to define an initial grub2 startup menu.
 
You can define a default menu entry and a timeout...
 
 agFM theme (mymenu=0)
 
Instead, for fastest performance, you can define a non-themed, text-based startup_menu with the colours and background wallpaper of your choice...
text mode (mymenu=2)
 
or change the 'slack' theme to use your own wallpaper and add a Menu heading, etc....
 theme mode (mymenu=1)
 
To configure your own startup menu, rename the \boot\grubfm\SAMPLE_startup_menu.txt file to startup_menu.txt.
Edit the startup_menu.txt file as required (instructions are inside the file).
 
The main agFM File Manager menu system can also use your new theme or the default theme.
 
Tip: To automatically open agFM at the \_ISO\MAINMENU folder, change the startup_menu.txt file to:
 
set timeout=0
 
and add in the red line below...
 
# === DO NOT CHANGE ANY LINES BELOW HERE ===
 
#grubfm must not be menu entry 1 or above (either 0 or remove this entry)
menuentry "a1ive grub2 File Manager" --class=dir {
grubfm "(hd0,msdos1)/_ISO/MAINMENU/"
}
 
BEWARE: Paths, filenames and extensions are CaSe SeNsiTiVe!
 
By default, the E2B agFM only lists 'bootable' files in the agFM menu system. You can use the F4 settings menu to also 'Display non-bootable files'.
 
  • You can change the default language.
  • You can also add a master password prompt.
  • You can add SubMenus to the bottom of the Startup menu.
  • Use the default theme, set background wallpaper+text mode or use your own theme and background
 

Change the agFM wallpaper, colour scheme or theme

agFM v1.15 and later versions allow you to change the theme and use your ow n wallpaper for the main agFM theme by using a \boot\grubfm\startup_menu.txt file (see above).
 
Note that the icons used in the sample_slack theme are used by the agFM menu system. If you use a different theme from 'slack' then you will need to copy the icons folder into your new theme.
 
Grub2 theme info can be found here.
 

Debugging

If you have problems booting any file, try disabling auto-run to enable the secondary auto-run menu - use the 'F4' menu. You may then be able to select a different boot method
 
In any grub2 menu, you can enable the screen pager by typing:
e  (to edit a menu entry)
F2 (to get to grub2 console)
set pager=1  (to enable screen paging)
ESC (return back to menu)
 
or type c (to get to grub2 command shell)
 
If you are using your own .cfg or .grubfm menu file, you can add debug lines such as:
 
echo myvar=*${myvar}*  (display variable value with * either side)
ls /          (list files)
ls            (list devices)
ls (hd0,msdos1)   (list files on second partition)
ls (hd0,msdos2)   (list files on first partition)
sleep 3    (delay for 3 seconds)
read        (wait for user input)
set          (view environment variables - use set pager=1 first to see all in list)
 
If pressing ESC does not work from the grub2 console, try the normal command.
If you exit to the UEFI shell, select the Ptn2:\grubfmx64.efi file to reboot to agFM.
 
To debug your .cfg and .grubfm files ou can directly edit the grub2 menu and change\add lines by pressing e when in the grub2 menu system.
 

Available icons (used with --class=)

 
 

Fn Menu Keys

F1 - Help (including About for version number)
F2 - File Manager - press F2 if you need to return back to the File Manager menu system
F3 - OS Detect - find and boot from bootable partitions
F4 - Settings - language, various settings including T to disable the graphical menu in case of a slow menu, and R to change screen resolution
F5 - pxe menu (TBD)
F6 - Reboot, Shutdown, EFI Shell, grub2 console and version
 
If you have UEFI-booted, pressing LeftAlt+LeftCtrl+F12 will save a screenshot to a .PNG file (typ. 500K) in the root of the FAT32 partition.
 
A long menu entry (filename) can be scrolled left or right using Ctrl+R or Ctrl+L.
 
 

Languages

a1ive has made the File Manager available in a few  different languages.  
 
Use the F4 hotkey to change the language.
 
You can set the language on boot using the \boot\grubfm\startup_menu.txt file, e.g. for German, use:
 
#set language: en_US, ru_RU, fr_FR, tr_TR, ko_KR, ja_JP, zh_CN, de_DE, he_IL, vi_VN, es_EM, zh_TW
export lang=de_DE
 
Some menu entries may still be in English.
 
  • English (US)
  • Russian
  • French
  • Turkish
  • Korean
  • Japanese
  • Chinese
  • German
  • Hebrew (Israel)
  • Vietnamese
  • Spanish
  • Taiwanese
You can change the keyboard map (e.g. for an AZERTY or QWERTZ keyboard), use the '\Change keyboard map.cfg' file in the E2B FAT32 partition (agFM v1.29+). Default language+keyboard type can also be pre-set in the startup_menu.txt file (see below). Note that this causes the keyboard to become unresponsive on many systems and so it is not recommended to use the 'at_keyboard' console setting!
 

Payloads

See here (bottom of page) for tested payloads and how to boot them.
 

'Non-Secure boot only' 

The first UEFI64 boot file is a special 'Kaspersky' signed shim. If you do not want to use this shim so that UEFI64 booting then we must replace the BOOTX64.EFI file with the grubfmx64.efi file:
1. Delete the file \EFI\BOOT\BOOTX64.EFI
2. Copy the file \grubfmx64.efi to \EFI\BOOT\ folder
3. Rename the file to \EFI\BOOT\BOOTX64.EFI
 
This means that you can no longer UEFI64 Secure Boot to the agFM menu on any Secure system!
You must instead use .imgPTN files containing signed EFI boot files if you want to Secure Boot to different payloads.
 
 

TroubleShooting

"Windows could not update the computer's boot configuration." error at end of first phase of UEFI Windows Install - Solution: Use a Removable E2B USB drive instead of a USB Hard Disk or convert the ISO to a .imgPTN23 file or boot to any WinPE and install using WinNTSetup.exe.
 
If you switch to a .imgPTN file or a .imgPTN23 file and have problems booting to the agFM after rebooting, you can use the UEFI Shell to select the \grubfmx64.efi file on the 2nd FAT32 partition - UEFI Shell - Boot Maintenace Manager - Boot from File - select partition and file.
 
Alternatively, run SWITCH_E2B.exe from Window or WinPE and click on the 'Restore E2B partitions' button.
Another alternative is to MBR-boot to the CSM menu and select option 0.
 
If any .imgPTN files fail to switch-in, check that the partitions on the E2B USB drive are correct.
Partition 1: NTFS - Type 07 (must contain E2B files)
Partition 2: FAT32 - Type 0B, 0C or 0E
 
Use 'RMPartUSB - Drive Info - 0' to examine the partition table in the MBR (LBA0).
 
A backup of the MBR is made to LBA30 and LBA60.
 
Note: If you have a \boot\grubfm\startup_menu.txt file, a diagnostic menu can be enabled (agFM v1.13 or later).
 
alloc magic is broken at 0xxxxxxxxx : x  - Aborted - this message indicates a theme error - check paths of theme files and paths of files specified inside each theme .txt file in the \boot\grubfm\themes\slack folder.
 
 

Will not UEFI boot?

To UEFI-boot, there must be a FAT partition present.
 
Many UEFI BIOSes will refuse to 'see' or UEFI-boot from an MBR drive if the partitions are not in ascending order or if any of the partitions overlap.
Any MBR partition of entry type 0 however, will be ignored by the UEFI BIOS checks.
 
The four 'START POS' entries in the partition table must be in ascending order and must not overlap.
e.g. The table below is invalid because Ptn2 and Ptn3 use the same area and thus overlap.
 
Use RMPrepUSB - Drive Info - 0 to examine the USB drive partition table:
 
Partition 1   SIZE=59998.969MiB   Type: 07 NTFS\exFAT  *ACTIVE*
START POS   = CYL:0 HD:32 SEC:33       END POS = CYL:1023 HD:254 SEC:63
START (LBA) = 2,048 (00000800) SIZE (LBA) = 122,877,889 (0752F7C1) [End=122,879,936]
 
Partition 2   SIZE=1000MiB   Type: 0C FAT32LBA (2047GB max)       
START POS   = CYL:1023 HD:254 SEC:63       END POS = CYL:1023 HD:254 SEC:63
START (LBA) = 122,880,000 (07530000) SIZE (LBA) = 2,048,000 (001F4000) [End=124,927,999]
 
Partition 3   SIZE=1000MiB   Type: 0C FAT32LBA (2047GB max)       
START POS   = CYL:1023 HD:254 SEC:63       END POS = CYL:1023 HD:254 SEC:63
START (LBA) = 122,880,000 (07530000) SIZE (LBA) = 2,048,000 (001F4000) [End=124,927,999]
 
Partition 4 SIZE=0MiB Type: 00
START POS = CYL:0 HD:0 SEC:0 END POS = CYL:0 HD:0 SEC:0
START (LBA) = 0 (00000000) SIZE (LBA) = 0 (00000000)
 
 
If your suspect that a partition is causing the problem, change the partition ID type to 0 using a disk editor (e.g. BootIce - Parts Manage - (select ptn) - Modify ID - 0).
Change ID Type to 0 to remove a partition.
 
 

a1ive's  grub2 build

a1ive grub2 command primer is here.
 
Linux script to build agFM and copy files to shared folder with todays date:
 
#! /bin/bash
 
rm -frdv ./grub2-filemanager/
git clone --recursive https://github.com/a1ive/grub2-filemanager.git
cd grub2-filemanager
./update_grub2.sh
echo 3 | ./build.sh
mv ./grubfmia32.efi ./grubia32.efi
mkdir /home/steve/Desktop/sf_MINT/"$(date +"%d-%m-%Y")"
cp ./*.7z /home/steve/Desktop/sf_MINT/"$(date +"%d-%m-%Y")"
cp ./*.efi /home/steve/Desktop/sf_MINT/"$(date +"%d-%m-%Y")"
cp ./*.iso /home/steve/Desktop/sf_MINT/"$(date +"%d-%m-%Y")"
ls  -l /home/steve/Desktop/sf_MINT/"$(date +"%d-%m-%Y")"/*
 

Known grub2/agFM Issues

  1. Files with $ characters in the file name won't work. Solution: Don't use $ in filenames (use standard ASCII characters or try #).
  2. Switching to .imgPTN files or switching back using Restore_E2B.cfg may give a 'Problem making backup to LBA30' error. This is due to a problem with certain UEFI BIOSes (e.g. MacBook and Dell Vostro). Solution: Use Legacy booting or SWITCH_E2B.exe to switch in the image - or another PC.
  3. Some modified Windows Install ISOs may give a 'A media driver your computer needs is missing' error. Only standard Windows Install ISOs can be booted directly from ISO - make sure the Windows used contains USB drivers for your hardware. Solution: Convert the ISO to a .imgPTN23 file (add USB drivers to ISO if required - e.g. Win7).
  4. grub2 menu timeout sometimes does not work and picks the default option immediately (happens 1 in x times only on some systems). Solution: add line at top of startup_menu.txt file with 'read' command or don't use a timeout.
  5. When installing Windows get 'Windows could not update the computer's boot configuration. Installation cannot proceed'. - Possible due to the BCD file on the USB drive being corrupt (check the EFI\Microsoft\boot\BCD file on any USB FAT32 partition if doing an EFI install or delete it - if MBR-booting, check the \boot\BCD file on any partition on the USB drive. A good test is to temporarily rename the file and see if the problem goes away).
  6. Some systems may give a Secure Boot error. Solution: This is usually fixed by deleting the signatures from the DBx blacklist using a setting in the BIOS menu system. Alternatively switch in a .imgPTN23 image file which has signed boot files (e.g. Windows, Ubuntu, Red Hat, fedora, etc.) or turn off Secure Boot in the BIOS.
  7. Using a keyboard scancode file and the required command of 'terminal_input at_keyboard' causes keyboard issues on many UEFI systems. Do not use!
  8. All uppercase FAT short 8.3 filenames (e.g. FRED.cfg) under grub2 (and most Linuxes) are displayed as all lowercase (e.g. fred.cfg). Since filenames on FAT volumes are case-insensitive, you can use any case when using the filenames in grub2 menus.
  9. XML files containing a Product Key beginning with 'ASKME' are not supported by default. You must add your own .cfg file and replace the full 5x5 key (29 characters) with the desired Product Key. I suggest you use ASKME-ASKME-ASKME-ASKME-ASKME in XML files to be compatible with agFM and E2B.
  10. Cannot switch in .imgPTN files under UEFI32.
Windows 10 Secure Boot
Win 10 Update 1909 (2) causes Secure Boot issue as it blacklists the Kasperky shim
 
KB4541335 fixes issue by removing Kaspersky shim from blacklist
Make sure you do all Updates.
If it still won't Secure Boot to the Kaspersky shim, go into the BIOS Setup menu and delete the EFI DBx blacklist contents.