Hacker News Reader

Comment by i336_ | Hacker News Reader

A cool way to fix this if Microsoft doesn't want to (although I can't see it being that hard) would be to make a small stub that simply kills the AVX flags then chainloads through to NTLDR.

It would probably be quite a simple project to work on, and a fun way to learn about bootloader-level software development. Chainloading NTLDR is well-understood (and will never change), and being booted by BOOTMGR is also fairly well understood too. If I was running Windows at the moment I'd be seriously considering playing with this myself.

View on HN

It's easier to just patch NTLDR. I've made changes to it before - it's very well (if unofficially) documented.

Hah. Well, I expect an appropriately patched version of NTLDR will surface pretty soon then - especially considering the signing issues are moot (see elsewhere in this thread).

Yeah, but good idea about the stub loader. That was actually my first train of thought, too.

Would this work with Secure Boot enabled - doesn't everything have to be signed Microsoft ?

Ooooh. Good point - and I don't actually know. [EDIT: See comment below, XP doesn't do Secure Boot, the following is moot for this context.]

So... BOOTMGR (Win10) is chaining through to NTLDR to load WinXP. And either Win10 comes with a copy of NTLDR, or pokes around to find the one on the XP system.

By my reasoning, Secure Boot should say "okay" and happily start the machine when it decides BOOTMGR is okay, on the basis that BOOTMGR will verify whatever it loads. The question is whether BOOTMGR actually does that, and seeing as if it doesn't then there isn't really a boot trust chain, well, it probably does verify what it loads.

I fear this is something only Microsoft would be able to fix properly for users who want/need Secure Boot. Slightly ironic. But thinking about it, Secure Boot on XP is kind of like deadbolting your front door when your walls have completely disappeared (picture a door sitting in the middle of nowhere), because XP is officially EOL now.

Bootmgr won't chainload other bootloaders in UEFI mode, secure boot enabled or not, unfortunately.

Not even other signed and verified uefi bootloaders.

Ah, that answers that question then.

Secure Boot is UEFI only (can't be enabled unless you disable CSM support) so if you want to boot XP you won't have access to Secure Boot anyway

Ah, I see. I was getting Secure Boot confused with Trusted Boot, which was available in the XP era.

Reply on news.ycombinator.com