Booting a tiny Linux kernel would overwrite way too much RAM, destroying the exact data (like crypto keys) we want to recover. That's why my bootloader is strictly 512 bytes to minimize the footprint.

As for the shim bootloader: it only chainloads signed EFI binaries. To run a custom unsigned bare-metal dumper through it, you would have to use a known vulnerable version of shim (like the one from the BootHole vulnerability) to bypass the signature check for the next stage. It's possible in theory, but adds a massive layer of complexity compared to just using CSM.

Guys, I'm writing using a translator without AI now. Are you happy?