Bahar KURT kurtbahartr

Alright, you installed your first Linux distro. You didn't want to lose data, or have Windows lying around "just in case". However, you want to be able to boot into Linux without having to go through the boot menu again and again.

You've heard from your Linux user friends that Linux has a boot manager that also detects Windows, so you want Linux to be on top of Windows.

So, you do what others have been doing for years since UEFI came to be: Boot into BIOS, head to change the boot order. But, would you look at that! Linux didn't register itself to the BIOS's boot menu!

Then you go, "Okay, I've read online that efibootmgr can get this resolved just by changing the boot order!" That's supposed to work since this is UEFI, right?

So you boot back into Linux and use efibootmgr to change the boot order. However, the next boot still boots directly into Windows. You go to the boot menu and your order customization didn't register at all.

Prerequirements

Head over to the firmware setup and switch to secure boot's setup mode. Find this in the Boot tab.
Microsoft's secure boot certificates. The links are in the Resources section below. Using something akin to curl and wget will return error 403-Forbidden!
Root access. All of the following commands must run as root.
(Optionally) A safe environment outside of your computer to store these keys inside.

Creating and enrolling the keys

ATTENTION!

Brunch changed the way the EFI firmware is handled within the kernel, and `/sys/firmware/efi` is now called `/sys/firmware/brunchefi`. This guide relies on the fact that the mokutil provided in the Debian repos look into the `.../efi/` directory and not the latter. If you want to proceed with this guide, you have to compile mokutil and its dependencies with the new path yourself.

Prologue

ChromeOS is something so efficient yet sometimes so locked down OS and it's what I love the most about it. It provides you flexibility while locking down things that only researchers and power users would be concerned about.

Right as I downgraded my ChromeOS system and Brunch Framework back to stable releases and doing some random research about ChromeOS (I forgot what specifically), I came across this Google support article explaining the differences between regular ChromeOS and ChromeOS Flex, out of which this specific point caught my interest:

	Pulls the folder called "directory" in the internal storage to the current directory: adb pull /sdcard/directory .

	Pushes the file called "text.txt" to the internal storage: adb push text.txt /sdcard/

	It's possible to provide an absolute path for the requested path too. For example: adb pull /sdcard/Download/test.jpg C:\Users\Linda\Desktop\data\

	Use quotation marks (") if there's space in the path: adb pull "/sdcard/Download/Quick Share" "C:\Users\Linda\Documents\backup 20250626"

	Reboots the device: adb reboot

	#!/bin/bash

	if [[ "$@" =~ ^-h$ ]] \|\| [[ "$@" =~ ^-h\ ]] \|\| [[ "$@" =~ \ -h\ ]] \|\| [[ "$@" =~ \ -h$ ]]; then
	echo "usage: sign-mok.sh /path/to/module.ko ..."
	echo ""
	echo "kmodsign usually accepts only one module per invocation."
	echo "This script works with multiple modules because we work around this limitation with a for loop."
	exit
	fi

	Type Start End # Pages Attributes
	Available 0000000000000000-000000000009DFFF 000000000000009E 000000000000000F
	Reserved 000000000009E000-000000000009EFFF 0000000000000001 000000000000000F
	BS_Data 000000000009F000-000000000009FFFF 0000000000000001 000000000000000F
	Available 0000000000100000-00000000223E8FFF 00000000000222E9 000000000000000F
	LoaderCode 00000000223E9000-000000002FD2FFFF 000000000000D947 000000000000000F
	BS_Data 000000002FD30000-000000002FDAFFFF 0000000000000080 000000000000000F
	Available 000000002FDB0000-0000000035339FFF 000000000000558A 000000000000000F
	LoaderCode 000000003533A000-0000000035439FFF 0000000000000100 000000000000000F
	BS_Data 000000003543A000-0000000035BA8FFF 000000000000076F 000000000000000F