ao2.it
Antonio Ospite, attacchi teoristici

A friend of mine had a problem with his Windows 10 installation: the system booted but it was unresponsive, so it was not possible to enter the Windows Recovery Environment from Windows.

One thing to notice is that Windows 10 disables by default the familiar F8 boot menu, it can be re-enabled from a working installation, but that was not our case.

Here are, just for reference, some ways to force the system to enter the Windows Recovery Environment in Windows 10, listed in order of increasing desperation :).

Remember that Secure Boot needs to be disabled from the UEFI firmware menu in order to launch an EFI shell.

Hardware recovery button

Manufacturers can set up a Hardware recovery button to launch the Recovery Environment, and ideally they would also document what the button is!

In this case the computer was an Asus X553M laptop and we could not find any info about a key sequence to launch the Recovery Environment at boot (the usual F9 does not work).

By trial and error it turned out that either F10 or F11 —sometimes— work, but they have to be pressed before pressing the power button and kept pressed for a while, pressing the key intermittently apparently is not enough.

Launching the Recovery Environment from an EFI shell

Prepare an ESP on a USB drive, and copy an EFI shell on it.

The following example is about creating a small 128 MiB partition from a linux system and copying an x86_64 Shell.efi binary on it:

$ sudo parted /dev/sdX
GNU Parted 3.2
...
(parted) unit mib 
(parted) mkpart primary 1 129
(parted) name 1 ESP
(parted) set 1 esp on
(parted) q
$ sudo mkfs.vfat -F 16 /dev/sdX1
$ sudo mlabel -i /dev/sdX1 ::ESP
$ udisksctl mount -b /dev/sdX1
Mounted /dev/sdX1 at /media/ao2/ESP.
$ pushd /media/ao2/ESP
/media/ao2/ESP ~
$ wget "https://sourceforge.net/p/tianocore/edk2/ci/master/tree/ShellBinPkg/UefiShell/X64/Shell.efi?format=raw" -O Shell.efi
$ popd
~
$ sudo umount /media/ao2/ESP

Then launch the shell from the firmware setup menu of the Windows machine: there should be an item in the Save & Exit menu called Launch EFI Shell from filesystem device.

In the Hardware recovery button documentation it is explained what pressing the button does at a software level: the firmware will call bootmgfw.efi /RecoveryBCD, so this can be also done manually from an EFI shell, like this:

Shell> fs0:\EFI\Microsoft\Boot\bootmgfw.efi /RecoveryBCD

Make the Recovery Environment permanent across reboots

There is also a less elegant (and persistent) variant of the above, it is just a hack I found before of all the other better solutions.

It is possible to replace the main Boot Configuration Data file (BCD) in the ESP partition with the Recovery BCD, for example using an EFI shell, or using a linux live system booted from USB or CD.

The commands to enable and disable this hack can also put in an EFI script.

Here is for instance a possible enable_WindowsRE.nsh:

if not exist fs0:\EFI\Microsoft\Boot\BCD.bak then
  cp fs0:\EFI\Microsoft\Boot\BCD fs0:\EFI\Microsoft\Boot\BCD.bak
endif

cp fs0:\EFI\Microsoft\Recovery\BCD fs0:\EFI\Microsoft\Boot\BCD
fs0:\EFI\Microsoft\Boot\bootmgfw.efi

And the symmetric script disable_WindowsRE.nsh to restore the original BCD:

if exist fs0:\EFI\Microsoft\Boot\BCD.bak then
  cp -q fs0:\EFI\Microsoft\Boot\BCD.bak fs0:\EFI\Microsoft\Boot\BCD
  rm fs0:\EFI\Microsoft\Boot\BCD.bak
endif

fs0:\EFI\Microsoft\Boot\bootmgfw.efi

The scripts can be called from the EFI shell like this:

Shell> enable_WindowsRE.nsh

Force power off keeping the power button pressed

If none of the solutions above work another way to get into the Recovery Environment is to force a power off by keeping the power button pressed for some seconds, if done early in the boot process Windows will detect that there was a problem at the previous boot and load the Recovery Environment automatically.