EFI Image
Version 1.02 12/12/00 109
4.2 EFI Image Header
EFI Images are a class of files defined by EFI that contain executable code. The most
distinguishing feature of EFI Images is that the first set of bytes in the EFI Image file contains an
image header that defines the encoding of the executable image.
EFI uses a subset of the PE32+ image format with a modified header signature. The modification
to signature value in the PE32+ image is done to distinguish EFI images from normal PE32
executables. The “+” addition to PE32 provides the 64 bit relocation fix-up extensions to standard
PE32 format.
For images with the EFI image signature, the Subsystem values in the PE image header are
defined below. The major differences between image types are the memory type that the firmware
will load the image into, and the action taken when the image’s entry point exits or returns. An
application image is always unloaded when control is returned from the image’s entry point. A
driver image is only unloaded if control is passed back with an EFI error code.
// PE32+ Subsystem type for EFI images
#define IMAGE_SUBSYSTEM_EFI_APPLICATION 10
#define IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER 11
#define IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER 12
The Machine value that is found in the PE image file header is used to indicate the machine code
type of the image. The machine code types defined for images with the EFI image signature are
defined below. A given platform must implement the image type native to that platform. Support
for other machine code types are optional to the platform.
// PE32+ Machine type for EFI images
#define IMAGE_FILE_MACHINE_IA32 0x014c
#define IMAGE_FILE_MACHINE_IA64 0x0200
#define IMAGE_FILE_MACHINE_IBS 0xFC0D
An EFI image is loaded into memory through the LoadImage() Boot Service. This service loads
an image with a PE32+ format into memory. This PE32+ loader is required to load all the sections
of the PE32+ image into memory. Once the image is loaded into memory, and the appropriate
“fixups” have been performed, control is transferred to a loaded image at the
AddressOfEntryPoint reference according to the normal IA-32 or Itanium-based indirect
calling conventions. All other linkage to and from an EFI image is done programmatically.