Advanced UEFI Boot

Technical Documentation: Secure Boot Shim & PXE Loader

This document describes how the DiskCryptor EFI Boot Add-On works internally, covering both UEFI Secure Boot (shim-based) and PXE network boot operation.

Product page:
👉 DiskCryptor Advanced Boot Pack

Overview

The DiskCryptor EFI Boot Add-On extends DiskCryptor with:

  • A Secure Boot–compatible shim-based boot chain
  • A PXE-capable EFI loader for network boot scenarios

This add-on does not replace DiskCryptor; it extends its EFI boot infrastructure.

Secure Boot Architecture

Why a Shim Is Required

UEFI Secure Boot allows execution only of EFI binaries signed by trusted certificates.
On most systems, firmware trusts:

  • Microsoft UEFI CA
  • OEM certificates

Custom EFI loaders are not trusted by default.

Debian-Signed Shim

DiskCryptor uses the Debian-signed shim, which is:

  • Signed by a Microsoft-trusted certificate
  • Accepted by Secure Boot firmware without modification
  • Widely deployed by Linux distributions

The shim acts as a first-stage bootloader and trust anchor.

Custom Loader Trust via MOK

The DiskCryptor EFI loader is custom-built and therefore signed with a custom certificate.

To allow shim to load it:

  1. The DiskCryptor EFI loader is signed with a custom key
  2. The corresponding certificate must be enrolled using MOK Manager
  3. Enrollment is required once per system

After enrollment, the system boots normally.

Secure Boot Flow

UEFI Firmware
   ↓
Debian-signed shim (Microsoft-trusted)
   ↓
shim verifies custom certificate (MOK)
   ↓
DiskCryptor EFI Loader
   ↓
DiskCryptor boot process

Secure Boot remains enabled and intact throughout the entire chain.

PXE Boot Architecture

Purpose of PXE Support

PXE (Preboot Execution Environment) allows systems to boot over the network and is commonly used for:

  • Automated OS deployment
  • Recovery and forensic environments
  • Diskless systems
  • Centralized lab or enterprise setups

The DiskCryptor PXE EFI loader enables DiskCryptor to participate in these workflows.

PXE EFI Loader Design

The PXE component is a standalone EFI application that can be:

  • Loaded via DHCP/TFTP
  • Chainloaded from existing PXE environments
  • Used together with Secure Boot

When Secure Boot is enabled, PXE boot is combined with shim and MOK enrollment.

PXE Boot Flow

UEFI Firmware
   ↓
UEFI PXE Stack (DHCP / TFTP)
   ↓
PXE EFI Loader
   ↓
DiskCryptor EFI Loader
   ↓
DiskCryptor boot process

This design follows standard UEFI PXE behavior and does not rely on proprietary extensions.

Usage

After downloading the DiskCryptor EFI Boot Add-On, proceed as follows:

  1. Extract the downloaded archive.
  2. Copy the appropriate shim package into the existing DiskCryptor installation directory:
    • Shim_X64 for x64 (AMD64) systems
    • Shim_AA64 for ARM64 systems
  3. Ensure the ZIP file is placed directly in the DiskCryptor installation folder without renaming it.
  4. Start the DiskCryptor bootloader configuration wizard.

Once the shim package is detected, the bootloader wizard will automatically offer Secure Boot–compatible options and guide you through the remaining setup steps.

No manual EFI file manipulation is required.

Security Model Summary

  • Secure Boot is preserved end-to-end
  • No firmware modifications are required
  • Trust is explicitly delegated via MOK enrollment
  • Users retain full control over enrolled keys