"fake" PE... it's no wonder it works this way. base is BC570000, abort PC is BC570D34. take you "fake" PE and look at the offset of D34 (or 0xD34 - 0x138 from the .text), what it does. it's hard to sa

Thank you, Laszlo! Again, sorry for the impatience, I started to suspect, my posts aren't visible. Yes, I mistook the LoadOptions field of the Loaded Image Protocol for the one, describing image's EFI

excuse me my impatience, but is this thread visible at all? I can't believe noone in here could answer my simple questions about such a core functionality. maybe it's because I was too verbose, let's

Now looking closer to the supposed to be Attributes and FilePathListLength fileds of the Load Option descriptor, I noticed that it's just first 3 characters of the string. the string that with the Boo

anyone, please? The more I try to figure it out, the more it reveals that it's a bug. After that unsuccess with the LoadOptions in the image's Loaded Image Protocol instance, I went and enumerated Boo

Hello. Do I understand correctly, that LoadOptions field of the LOADED_IMAGE_PROTOCOL instance of an OS loader image, points to the Load Option descriptor, the format of which is described in the Boot