UNSOLVED
where is secure boot db (database) stored
The Windows 10 installer writes to the UEFI NVRAM (Non-Volatile RAM) by invoking UEFI runtime services during the final stages of installation. Specifically, it uses
bcdboot.exe to update boot entries, creating a new Boot#### variable to point to the \EFI\Microsoft\Boot\Bootmgfw.efi loader.
How Windows Writes to NVRAM:
EFI Variable Services: The installer calls standard UEFI firmware services (SetVariable) while in specialized Windows setup mode to modify NVRAM, which includes adding "Windows Boot Manager" to the boot order and creating entries in the db (Signature Database) for secure boot.
BCD Boot Tool: The bcdboot.exe utility is primarily responsible for writing the configuration data into the NVRAM, creating, or updating BootOrder and BootNext.
Secure Boot Keys: During initialization or updates, Windows can update Secure Boot keys (PK, KEK, DB) by writing to the respective firmware NVRAM variables
I was confused about this because I thought the system partition on boot drive has the db file. there is also a Windows copy in C:\Windows\EFI
(edited)
