How can we identify an ISO file is an EFI bootable ISO image?

How can we identify an ISO file is an EFI bootable ISO image?

[Heyi Guo]

Dear experts,

Is there any simple tool to parse ISO images (El Torito partition) and 
identify whether it is EFI bootable?

I think EFI bootable image should contain a FAT volume so that EFI can 
load bootxx.efi file from the file system.

Several tools like mount in Linux will show all files together including 
EFI/BOOT directory, so if an ISO image contains such files but not 
organizes the data in a FAT sub-volume as EFI requires, I can't see any 
difference.

So the tool would need to print the detailed internal structure 
information of El Torito ISO files. Is there something like that?

And is there any guide to create an EFI bootable El Torito ISO image?

Thanks and regards,

Gary (Heyi Guo)

Re: How can we identify an ISO file is an EFI bootable ISO image?

[Laszlo Ersek]

On 06/20/17 14:34, Heyi Guo wrote:
> Is there any simple tool to parse ISO images (El Torito partition) and
> identify whether it is EFI bootable?

$ dumpet --iso Fedora-Server-dvd-aarch64-25-20161015.n.0.iso

  Validation Entry:
          Header Indicator: 0x01 (Validation Entry)
          PlatformId: 0xef (EFI)                      <---------- [1]
          ID: ""
          Checksum: 0x66aa
          Key bytes: 0x55aa
  Boot Catalog Default Entry:
          Entry is bootable
          Boot Media emulation type: no emulation     <---------- [2]
          Media load address: 0 (0x0000)
          System type: 0 (0x00)
          Load Sectors: 9208 (0x23f8)
          Load LBA: 2456 (0x00000998)

The source for dumpet is at <https://github.com/rhboot/dumpet>.

> I think EFI bootable image should contain a FAT volume so that EFI can
> load bootxx.efi file from the file system.

For a large Wiki page on this, I can recommend:
<https://fedoraproject.org/wiki/User:Pjones/BootableCDsForBIOSAndUEFI>.

For a short summary, these are the commands you need, to format an
EFI-bootable (and EFI-only) CD-ROM:

(1) Create a non-partitioned FAT image in a file, with "mkdosfs -C", and
    populate it with the "mtools" utilities.

    For a heavier-weight (but also a lot more feature-ful) toolset, you
    can also use libguestfs / guestfish.

(2) Generate the ISO image like this:

    genisoimage -input-charset ASCII -J -rational-rock \
      -efi-boot "$FAT_IMAGE_FILE" -no-emul-boot \
      -o "$ISO_IMAGE" -- "$FAT_IMAGE_FILE"

    So what you do is, create an ISO9660 filesystem with the FAT image
    file copied into it as a normal file (simply to the root directory).
    You can enable Joliet and/or RockRidge extensions if you want to,
    but those aren't necessary. Then, you set the EFI boot image name
    with "-efi-boot" [1], and also specify that the boot image is a "no
    emulation" [2] image
    <https://en.wikipedia.org/wiki/El_Torito_(CD-ROM_standard)#Boot_modes>.

> Several tools like mount in Linux will show all files together
> including EFI/BOOT directory,

That directory, displayed as part of the ISO9660 filesystem that was
written to the ISO image / CD-ROM, is entirely irrelevant when it comes
to UEFI-bootability. I doesn't even need to exist, and if it does, it's
likely there only for convenience reasons (so that people don't have to
run "dumpet" or similar tools to extract the FAT image first, and then
the EFI binaries second, if they want to investigate the EFI binaries).

For UEFI boot, only the ElTorito image matters.

> so if an ISO image contains such files but not organizes the data in a
> FAT sub-volume as EFI requires, I can't see any difference.

In order to extract the ElTorito image(s), use "dumpet --dumpdisks", and
then work on the extracted files with guestfish or mtools. For example:

$ MTOOLS_SKIP_CHECK=1 mdir -i extracted.iso.0  -/ ::

Thanks
Laszlo

Re: How can we identify an ISO file is an EFI bootable ISO image?

[Rod Smith]

On 06/20/2017 12:47 PM, Laszlo Ersek wrote:
> On 06/20/17 14:34, Heyi Guo wrote:
> 
>> Several tools like mount in Linux will show all files together
>> including EFI/BOOT directory,
> 
> That directory, displayed as part of the ISO9660 filesystem that was
> written to the ISO image / CD-ROM, is entirely irrelevant when it comes
> to UEFI-bootability. I doesn't even need to exist, and if it does, it's
> likely there only for convenience reasons (so that people don't have to
> run "dumpet" or similar tools to extract the FAT image first, and then
> the EFI binaries second, if they want to investigate the EFI binaries).
> 
> For UEFI boot, only the ElTorito image matters.

MOSTLY, yes; however, some EFI implementations include ISO-9660 drivers.
This is definitely true of the EFI used by VirtualBox. I think I've seen
this feature on one or two UEFI-based PCs, too, but I don't recall the
details and I can't say I'm 100% certain of this. There are also
ISO-9660 drivers floating around that can be loaded from a FAT
partition. In either of these cases, the files on the ISO-9660
filesystem can be used to boot from an optical disc, even if it lacks
the El Torito image.

This is admittedly a corner case at best; but IMHO it's worth keeping in
mind, since non-matching El Torito and ISO-9660 files could lead to user
(or developer) confusion.

-- 
Rod Smith
rodsmith@rodsbooks.com
http://www.rodsbooks.com

Re: How can we identify an ISO file is an EFI bootable ISO image?

[Laszlo Ersek]

On 06/20/17 19:36, Rod Smith wrote:
> On 06/20/2017 12:47 PM, Laszlo Ersek wrote:

>> For UEFI boot, only the ElTorito image matters.
> 
> MOSTLY, yes; however, some EFI implementations include ISO-9660 drivers.
> This is definitely true of the EFI used by VirtualBox. I think I've seen
> this feature on one or two UEFI-based PCs, too, but I don't recall the
> details and I can't say I'm 100% certain of this. There are also
> ISO-9660 drivers floating around that can be loaded from a FAT
> partition. In either of these cases, the files on the ISO-9660
> filesystem can be used to boot from an optical disc, even if it lacks
> the El Torito image.

Good point!

> This is admittedly a corner case at best; but IMHO it's worth keeping in
> mind, since non-matching El Torito and ISO-9660 files could lead to user
> (or developer) confusion.

That has actually tripped up at least one OVMF user in the past; they
had some inconsistency between the two locations. The problem was
originally reported in  <https://github.com/tianocore/edk2/issues/93>
("OvmfPkg: UEFI Shell only sees EFI\BOOT\BOOTX64.EFI"), but now that the
edk2 github issue tracker is gone, the ticket cannot be viewed even in
read-only mode. :/

Thanks!
Laszlo

Re: How can we identify an ISO file is an EFI bootable ISO image?

[Heyi Guo]

Thank you so much. I will try that :)

Regards,

Gary (Heyi Guo)


在 6/21/2017 12:47 AM, Laszlo Ersek 写道:
> On 06/20/17 14:34, Heyi Guo wrote:
>> Is there any simple tool to parse ISO images (El Torito partition) and
>> identify whether it is EFI bootable?
> $ dumpet --iso Fedora-Server-dvd-aarch64-25-20161015.n.0.iso
>
>    Validation Entry:
>            Header Indicator: 0x01 (Validation Entry)
>            PlatformId: 0xef (EFI)                      <---------- [1]
>            ID: ""
>            Checksum: 0x66aa
>            Key bytes: 0x55aa
>    Boot Catalog Default Entry:
>            Entry is bootable
>            Boot Media emulation type: no emulation     <---------- [2]
>            Media load address: 0 (0x0000)
>            System type: 0 (0x00)
>            Load Sectors: 9208 (0x23f8)
>            Load LBA: 2456 (0x00000998)
>
> The source for dumpet is at <https://github.com/rhboot/dumpet>.
>
>> I think EFI bootable image should contain a FAT volume so that EFI can
>> load bootxx.efi file from the file system.
> For a large Wiki page on this, I can recommend:
> <https://fedoraproject.org/wiki/User:Pjones/BootableCDsForBIOSAndUEFI>.
>
> For a short summary, these are the commands you need, to format an
> EFI-bootable (and EFI-only) CD-ROM:
>
> (1) Create a non-partitioned FAT image in a file, with "mkdosfs -C", and
>      populate it with the "mtools" utilities.
>
>      For a heavier-weight (but also a lot more feature-ful) toolset, you
>      can also use libguestfs / guestfish.
>
> (2) Generate the ISO image like this:
>
>      genisoimage -input-charset ASCII -J -rational-rock \
>        -efi-boot "$FAT_IMAGE_FILE" -no-emul-boot \
>        -o "$ISO_IMAGE" -- "$FAT_IMAGE_FILE"
>
>      So what you do is, create an ISO9660 filesystem with the FAT image
>      file copied into it as a normal file (simply to the root directory).
>      You can enable Joliet and/or RockRidge extensions if you want to,
>      but those aren't necessary. Then, you set the EFI boot image name
>      with "-efi-boot" [1], and also specify that the boot image is a "no
>      emulation" [2] image
>      <https://en.wikipedia.org/wiki/El_Torito_(CD-ROM_standard)#Boot_modes>.
>
>> Several tools like mount in Linux will show all files together
>> including EFI/BOOT directory,
> That directory, displayed as part of the ISO9660 filesystem that was
> written to the ISO image / CD-ROM, is entirely irrelevant when it comes
> to UEFI-bootability. I doesn't even need to exist, and if it does, it's
> likely there only for convenience reasons (so that people don't have to
> run "dumpet" or similar tools to extract the FAT image first, and then
> the EFI binaries second, if they want to investigate the EFI binaries).
>
> For UEFI boot, only the ElTorito image matters.
>
>> so if an ISO image contains such files but not organizes the data in a
>> FAT sub-volume as EFI requires, I can't see any difference.
> In order to extract the ElTorito image(s), use "dumpet --dumpdisks", and
> then work on the extracted files with guestfish or mtools. For example:
>
> $ MTOOLS_SKIP_CHECK=1 mdir -i extracted.iso.0  -/ ::
>
> Thanks
> Laszlo