Search code examples
wdkwindows-kernel

Reliable way to detect if the firmware is UEFI or BIOS from a Windows kernel driver


Is there any reliable way to detect if the firmware is BIOS or UEFI from a Windows kernel driver in runtime without access to the disk?


Solution

  • Try ExGetFirmwareEnvironmentVariable function. Call this function with empty variable name and dummy GUID to determine if Windows was installed using BIOS or UEFI. For more details, see the followings as stated in the documentation.

    Firmware environment variables are not supported on a legacy BIOS-based platform. Calls to ExGetFirmwareEnvironmentVariable always fail on a legacy BIOS-based platform; they also fail if Windows was installed using the legacy BIOS on a platform that supports both legacy BIOS and UEFI. To identify these conditions, call the function with a dummy VariableName string (for example, an empty string) and a dummy GUID such as

    "{00000000-0000-0000-0000-000000000000}"

    for the VendorGuid parameter. On a legacy BIOS-based platform, or on a platform that supports both legacy BIOS and UEFI but in which Windows was installed using the legacy BIOS, the function will fail with STATUS_NOT_IMPLEMENTED. On a UEFI-based platform, the function will fail with an error specific to the firmware, such as STATUS_VARIABLE_NOT_FOUND, to indicate that the dummy GUID namespace does not exist.